diff --git a/scripts/patch-federation-unlisted-guards.mjs b/scripts/patch-federation-unlisted-guards.mjs
index 47e6d1e2..39c8b05e 100644
--- a/scripts/patch-federation-unlisted-guards.mjs
+++ b/scripts/patch-federation-unlisted-guards.mjs
@@ -2,13 +2,39 @@ import { access, readFile, writeFile } from "node:fs/promises";
 
 // activitypub index.js and federation-setup.js unlisted guards are now
 // built into the fork — only endpoint-syndicate (separate package) needs patching.
+// backfill-timeline.js also needs patching — it runs on every startup and
+// backfills ap_timeline from posts without filtering unlisted posts.
 
 const endpointSyndicateCandidates = [
   "node_modules/@indiekit/endpoint-syndicate/lib/utils.js",
   "node_modules/@indiekit/indiekit/node_modules/@indiekit/endpoint-syndicate/lib/utils.js",
 ];
 
+const backfillTimelineCandidates = [
+  "node_modules/@rmdes/indiekit-endpoint-activitypub/lib/mastodon/backfill-timeline.js",
+];
+
 const patchSpecs = [
+  {
+    name: "backfill-timeline-unlisted-guard",
+    candidates: backfillTimelineCandidates,
+    oldSnippet: `  const allPosts = await posts
+    .find({
+      "properties.post-status": { $ne: "draft" },
+      "properties.deleted": { $exists: false },
+      "properties.url": { $exists: true },
+    })
+    .toArray();`,
+    newSnippet: `  const allPosts = await posts
+    .find({
+      "properties.post-status": { $ne: "draft" },
+      "properties.deleted": { $exists: false },
+      "properties.url": { $exists: true },
+      // Exclude unlisted posts — they must not appear in ap_timeline (Mastodon API).
+      "properties.visibility": { $ne: "unlisted" },
+    })
+    .toArray();`,
+  },
   {
     name: "endpoint-syndicate-source-url-unlisted-guard",
     candidates: endpointSyndicateCandidates,